PT-2026-3643 · Unknown · Binary-Parser

Keichi · Publicado 2026-01-20 · Atualizado 2026-02-03 · CVE-2026-1245

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions binary-parser versions prior to 2.3.0

Description A code injection flaw exists in the binary-parser library. This issue allows for arbitrary JavaScript code execution when untrusted values are used in parser field names or encoding parameters. The library directly interpolates these values into dynamically generated code without proper sanitization, enabling attackers to execute code within the Node.js process. The issue is due to the use of the Function constructor with unsanitized input. This could lead to data access, logic manipulation, or system command execution. The vulnerability is also referred to as 'ParserPoison'.

Recommendations Upgrade to binary-parser version 2.3.0 or newer.

Correção

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2026-1245

GHSA-M39P-34QH-RH3W

Produtos afetados

Binary-Parser

Referências · 24

• https://github.com/keichi/binary-parser/pull/283 · Nota
• https://github.com/keichi/binary-parser · Nota
• https://twitter.com/TheHackersNews/status/2016152560869220423 · Publicação no Twitter
• https://kb.cert.org/vuls/id/102648 · Nota
• https://twitter.com/PurpleOps_io/status/2014247290374905960 · Publicação no Twitter
• https://t.me/thehackernews/8290 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2026-1245 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-1245 · Nota de Segurança
• https://twitter.com/IT_news_for_all/status/2016153023169298730 · Publicação no Twitter
• https://twitter.com/dailytechonx/status/2014365193971646657 · Publicação no Twitter
• https://npmjs.com/package/binary-parser · Nota
• https://cve.org/CVERecord?id=CVE-2026-1245 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-m39p-34qh-rh3w · Aviso do Fabricante
• https://twitter.com/ThreatSynop/status/2014291685824418067 · Publicação no Twitter
• https://twitter.com/Karma_X_Inc/status/2014307946105016344 · Publicação no Twitter